The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests and follows instructions from external project files to perform code generation.
Ingestion points: The skill reads design grammar, adapters, recipes, and manifests from files located in the .styleseed/ directory (SKILL.md, Instruction 1).
Boundary markers: The instructions do not specify any delimiters or safety warnings for the data read from these files, which may allow embedded instructions to override intended behavior.
Capability inventory: The skill uses Bash for artifact resolution and possesses Write and Edit permissions for modifying the file system (Frontmatter: allowed-tools).
Sanitization: There is no evidence of validation, escaping, or filtering of the contents of the .styleseed files before they are used to influence the agent's logic.

ss-page